I'm trying to debug a malware sample that installs to a system as service and then will only start if it starts as a service. Other functions are still available without the service start, like configuring or install under a different name.
I'm trying to catch the network communications the malware is sending and receiving as soon as it starts as a service. If I attach to a running service/process with Immunity it already has sent the network packets and received, and I've missed what it has done with them. If I try to start it any other way I get the following error:
Is there another way to go about this? Or some workaround? I'm fairly new to this so I certainly be missing some obvious.